Information Management Assessment

A review of good practice from the IMA programme, 2008-16

Section 4: Policy, guidance and oversight Contents

1 Providing direction 3

Defining and communicating clear policy and guidance Training and supporting staff

2 Measuring impact 8

Assessing compliance with policy

Note: references are to the named individuals, roles and organisations as they operated at the time of the Information Management Assessment or progress review

© Crown copyright 2016.

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk

1. Providing direction

IMA Goal: The organisation gives staff the instruction they need to manage, protect and exploit information effectively.

Defining and communicating clear policy and guidance

The Section 46 Code of Practice highlights the importance of having an information and records management policy to provide a mandate for the central team and a framework for supporting standards, procedures and guidelines.¹ In addition to criteria noted elsewhere in our good practice report, it states that the information and records management policy should:

- Set out the authority’s commitment to create, keep and manage records which document its principal activities.
- Outline the role of records management and its relationship to the authority’s overall business strategy.
- Identify and make appropriate connections to related policies, such as those dealing with email, information security and data protection.

Our assessments consider whether policy and supporting guidance is up-to-date, relevant, proportionate, easy to understand and readily available.² We also assess whether policy and guidance covering the protection, management and exploitation of information has been positioned to deliver a single, consistent message.

The Section 46 Code of Practice suggests that departments should publish their records management policies so that members of the public can see the basis on which they manage their records. Sir Alex Allan’s Records Review recommended that departments should also publish retention or ‘what to keep’ schedules, setting out their policies on what types of records to keep,

¹ nationalarchives.gov.uk/information-management/manage-information/planning/records-management-code/ ² nationalarchives.gov.uk/information-management/manage-information/ima/ and for how long. The report stated that this would help provide greater transparency on departments’ decisions on retention and disposal.

**Department for Work and Pensions (DWP), 2014 IMA**

We recognised that amount of effort that DWP had invested in supporting its policy with a range of tailored guidance. The IMA report noted:

‘There is a wealth of other KIM policies and guidance covering all aspects of the RM [records management] lifecycle. These are all available on the intranet and many of the staff we spoke to knew about them and used them. Much of the guidance has also been broken down into “desk aids” to make it easier to understand and help staff have the guidance to hand as they carry out their work.’

**Northern Ireland Office (NIO), 2016 IMA**

A clear, succinct, inclusive and accessible information and records management policy was in place covering information management, information security, information governance and managing corporate knowledge. This policy highlighted key risks and department-specific principles, setting out responsibilities for information management across NIO and guiding principles:

‘Northern Ireland Office recognises and values information as a corporate asset.

- We manage information to support business needs.
- We maintain information to meet our statutory obligations.
- We identify information for preservation of the historic record.
- We do not keep information longer than required.
- We recognise and manage information risk.

______________________________________________________________________

3 [www.gov.uk/government/publications/records-review-by-sir-alex-allan](http://www.gov.uk/government/publications/records-review-by-sir-alex-allan) The Ministry of Justice (MoJ), 2016 IMA reassessment

MoJ had produced a comprehensive set of guidance covering all aspects of information and records management. This was clearly visible on the intranet. A high-level What to Keep policy had been produced and each business area had a retention schedule in place. The IMA reassessment report noted:

‘There are over 95 record retention and disposition schedules that govern the departmental records. These cover all types of records and state when they can either be destroyed or kept for review after 20 years. MoJ has published these in line with Sir Alex Allan’s recommendation in his Report on Records Review.

‘MoJ also has an Information Review and Disposal Policy that links in with the above. The what-to-keep guidance is clear, succinct and easy to read. The retention schedules are developed and updated in conjunction with business areas to ensure that these work in practice and the right information is kept to enable business areas to carry out their work.’

Training and supporting staff

Organisations should provide training to staff. This should be done to ensure that staff understand how policy and guidance should be applied and how IT systems should be used. We recommend that organisations should use available channels from staff inductions to poster, leaflet or email campaigns to set expectations and educate staff on the importance of information and records management.

HM Treasury, 2015 IMA reassessment

All staff were required to complete face-to-face induction training in information and records management. The IMA report noted:

‘Two sessions are provided. One is run in the form of a quiz that conveys the KIM message and tests staff knowledge in a fun and interactive way. It includes multiple-choice questions, such as “How many Knowledge Champions are there and who is the Senior Sponsor for Knowledge Management?” The other session gives a more formal, high-level view, addressing the business and compliance value of KIM. It also includes some useful top tips for staff.

1. Don’t leave it until Friday, file as you go
2. Don’t be a slave to email
3. Get to know your knowledge champion and site owner
4. Let people know who you are – look after your MySite profile
5. Explore our e-resources
6. Learn more about search and discovery.’

Ministry of Defence (MOD), 2011 IMA MOD had introduced a ‘Defence Information Management Passport’. This consisted of an e-learning package and questionnaire and was intended to educate staff and raise standards in records and information management. The passport received high-level backing from the Second Permanent Secretary. Two locations visited during the IMA had made completion of the Information Management Passport mandatory before assumption of duties. The IMA report noted that business areas:

‘… have set their own targets for completion, allowing them to take local business need into account. MOD expects units to achieve level 2 compliance with the Defence Information Management Skills Maturity Model by December 2012.’

Department of Energy and Climate Change (DECC), 2014 progress review Following its IMA, DECC began to provide its own, in-house training. The progress review noted:

‘All new starters at DECC now receive an induction session with the Departmental Records Officer (DRO) as part of their overall corporate induction. The induction covers compliance with the Data Protection Act and the [Freedom of Information Act] as well as the importance of saving information within the Electronic Document and Records Management System (EDRMS) and the benefits of sharing corporate expertise and knowledge.' 2. Measuring impact

IMA Goal: The organisation measures performance in practice and takes informed risk-based action as a result.

Assessing compliance with policy

Once policy and guidance are in place, organisations must ensure that they know if it is being followed in practice. The Section 46 Code of Practice states that an information and records management policy should ‘indicate how compliance with the policy and the supporting standards, procedures and guidelines will be monitored’.

If information and records management practice is understood, then bad practice can be addressed and behaviours can be challenged. At the same time, organisations can also use performance monitoring to identify and share good practice, encouraging others to raise their game. Where there is a specific need, organisations can also collect performance measures and use them to target specific behaviours. These might include numbers of email accounts over a particular size, or the number and type of documents that business areas are saving to an Electronic Document and Records Management System (EDRMs).

A flexible approach to performance monitoring means that emerging priorities can be emphasised, while a competitive element can be introduced by publishing and publicising results. At the same time, organisations should ensure their approach is proportionate to encourage business engagement in and ownership of the process. The Department of Health, 2014 IMA

An internal programme of assessments had been established to monitor compliance with the Department of Health’s information management policy. Assessments measured business areas against the department’s five information management goals, set out in its information management policy, with an additional heading covering training and awareness. The IMA report noted:

‘A sample report provided to the assessment team shows that business areas are provided with quick wins and longer-term recommendations… Although recommendations place an emphasis on encouraging rather than mandating, it is clear that the department is using the process to target identified priorities and concerns such as email storage. It is also clear that, in line with the department’s inclusive information management policy, the focus of the process is wide. Questions extend to cover the promotion of transparency outcomes, knowledge capture and exit processes, access to calendars and the maintenance of Directory entries.’

HM Treasury, 2015 IMA reassessment

HM Treasury used a self-assessment KM Benchmarking process to measure compliance with its KIM policy. The report noted:

‘Each business area scores KIM activities against a maturity model which describes what has to be achieved against each score. The assessments are carried out in hour-long team meetings. The Knowledge Champion facilitates the assessment and a member of the Knowledge and Information Management team moderates the session. Teams provide evidence of good practices to support the scores achieved. Scoring is on a scale of 1 to 5 (1 aware, 2 first steps, 3 defined, 4 managed, 5 embedded), although scores of 0 can be given in exceptional circumstances. Business areas that are not performing well have to repeat the process and, if they don’t improve, they have to meet with the Second Permanent Secretary to explain why … Following the benchmarking, business areas are expected to produce an action plan to demonstrate how they are going to improve practice.'

**Home Office, 2015 IMA**

Information assurance was incorporated into Home Office’s existing information management maturity model – I3M – in 2013, to form a new single information maturity model, One3M. The IMA report noted:

‘Assessing performance against the model is a mandatory requirement in six Home Office Groups and five of the department’s arm’s length bodies, but may be undertaken by other areas on a voluntary basis. The model was introduced with the explicit aim of helping to drive a culture of excellence in information management, embedding good information management and encouraging improved behaviours across the Group. Interviewees described One3M as “a flexible model that changes to accommodate new areas of focus”. We saw positive evidence of a commitment to ensuring it continues to develop and evolve. This can, for example, be seen in the decision to add questions on cyber security to the 2014-15 version of the maturity model.’

**The Department for Environment, Food and Rural Affairs (Defra), 2013 progress review**

Defra had a programme of information audits in place at the time of its 2011 IMA, strongly supported by our report. Following the IMA, the department reviewed and revised its approach to measuring performance. The 2013 Defra progress review noted the departments on-going efforts in this area:

‘Information audits … have been replaced by a system of [lighter touch] information health checks aimed at incentivising staff themselves to improve the management of knowledge and information at the local level. These reviews are conducted jointly by knowledge partners in the knowledge services team at the request of business.’ The Information and Records Management Service (IRMS) team was running a programme of health checks that drew on face-to-face interviews with Record Officers and other relevant members of staff, and on statistics on systems usage. The IMA report noted:

‘This range of sources provides qualitative and quantitative insights into culture and performance. IRMS can, for example, identify whether apparently good engagement with SPIRE is down to a team-wide ethic or to the action of a few team members. By looking at document types stored, IRMS could also highlight where a relatively small volume of emails were being stored, suggesting that key context was not being captured.’